[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSAm7LsfKBTSXNxadv8d5TvWfJYx1bXe8Xa_ckhPllTY":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":28},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"4e44feeb-ef3c-40b5-9561-e8b7df02c2dc","Exchange for breakfast: Turla’s Cereal tricks are not for kids","exchange-for-breakfast-turla-s-cereal-tricks-are-not-for-kids-fd8e71","ESET Research describes Turla’s Cereal toolset, featuring a novel Exchange email collection module, a unique C&C mechanism, and sophisticated .NET execution tricks","ESET Research has identified a new toolset, dubbed 'Cereal', deployed by the Russia-aligned APT group Turla on Microsoft Exchange servers. This modular .NET malware is designed for long-term cyberespionage, capable of executing commands in memory, mapping compromised organizations, and collecting specific emails. Notably, Cereal utilizes the victim's Exchange server as its command and control infrastructure, avoiding external C2 servers.","Turla APT group deploys Cereal toolset on Exchange servers for espionage.","https:\u002F\u002Fwww.welivesecurity.com\u002Fen\u002Feset-research\u002Fexchange-for-breakfast-turlas-cereal-tricks-are-not-for-kids\u002F","https:\u002F\u002Fweb-assets.esetstatic.com\u002Fwls\u002F2026\u002F11-26\u002Fturla-cereal\u002Fexchange-turla-cereal-tricks.jpg","2026-11-10T09:57:00+00:00","2026-11-11T07:00:31.056766+00:00",9,[17,20,23],{"name":18,"type":19},"Turla","threat_actor",{"name":21,"type":22},"Microsoft Exchange","product",{"name":24,"type":25},".NET","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":26,"icon":28,"name":29,"slug":30},null,"Nation-state","nation-state",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53],{"type":43,"value":51,"context":52},"Cereal","Name of the modular .NET malware toolset",{"type":43,"value":54,"context":55},"Snake","Alternative name for the Turla APT group",[21],{"controls":58,"vendors":143},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":89,"name":90,"problem":91,"products":92},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":118,"name":119,"problem":120,"products":121},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[122,130,135],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":131,"product_name":132,"url":133,"description":134},"darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[144,150],{"slug":145,"name":146,"logo_path":147,"roles":148},"eset","ESET","\u002Fvendor-logos\u002Feset.png",[149],"reported_by",{"slug":151,"name":152,"logo_path":153,"roles":154},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[155],"affected"]